Tips & Tricks
Short, practical notes from the field: tooling, tradecraft, and shortcuts.
Active Directory
16
Windows and Active Directory tradecraft.
AI & LLM Security
19
Auth & Tokens
12
Cloud & Containers
13
Cloud and identity tips.
Exploitation
2
Turning bugs into working access.
Linux & Privesc
8
Linux tips and privilege escalation.
Recon & OSINT
11
Finding attack surface and mapping targets.
Red Team & Evasion
9
Source Code Review
31
Web & API
22
Web application testing tips.
Windows Post-Exploitation
8
All tips
- Trace SpEL and OGNL expression injection in Java User input concatenated into a Spring Expression or OGNL evaluation is direct code execution.
- Flag Java deserialization and unsafe Jackson typing ObjectInputStream on untrusted data and Jackson default typing are both direct paths to RCE with a classpath gadget.
- Hunt PHP object injection at every unserialize User-controlled input into unserialize plus a class with magic methods equals remote code execution through a POP chain.
- Review by sources and sinks, not top to bottom Enumerate every input source and every dangerous sink first, then only read the code that connects them.
- Break output guardrails by controlling the answer channel When a separate model checks the final answer, you can route the payload through a channel the checker does not read, like code or a citation.
- Turn model file access into local file read Agents with a file or code tool often resolve paths relative to the server, so traversal reads configs and secrets.
- Model denial of wallet through expensive prompts Unbounded output or recursive tool loops let a cheap request run up huge token bills or exhaust an agent's step budget.
- Cross-tenant leakage through a shared vector store If embeddings from multiple tenants share an index without a metadata filter on every query, one tenant can retrieve another's chunks.
- Adversarial suffixes against an LLM judge When an LLM scores or moderates content, an appended suffix can flip its verdict without changing the visible meaning.
- Structured-output smuggling in JSON mode Forcing JSON output does not stop injection; attacker content can populate fields that downstream code executes or trusts.